Anomaly recognition method for data streams

ABSTRACT

This invention identifies anomalies in a data stream, without prior training, by measuring the difficulty in finding similarities between neighbourhoods in the ordered sequence of elements. Data elements in an area that is similar to much of the rest of the scene score low mismatches. On the other hand a region that possesses many dissimilarities with other parts of the ordered sequence will attract a high score of mismatches. The invention makes use of a trial and error process to find dissimilarities between parts of the data stream and does not require prior knowledge of the nature of the anomalies that may be present. The method avoids the use of processing dependencies between data elements and is capable of a straightforward parallel implementation for each data element. The invention is of application in searching for anomalous patterns in data streams, which include audio signals, health screening and geographical data. A method of error correction is also described.

This invention relates to a system for recognising anomalies containedwithin a set of data derived from an analogue waveform, particularly,though not exclusively, for locating noise in an audio signal. Theinvention may be applied to data from many different sources, forexample, in the medical field to monitor signals from a cardiogram orencephalogram. It also has application in the field of monitoringmachine performance, such as engine noise. A noise removal system isalso described for use in combination with the present invention.

Audio signals may be subject to two principal sources of noise: impulsenoise and continuous noise.

There are a number of existing techniques for dealing with both sorts ofnoise. In particular, in order reduce the effects of continuous noise,such as a background “hum” in audio data, low-pass filters, dynamicfilters, expanders and spectral subtraction are used. However, thesetechniques suffer from the disadvantage that the characteristic of thenoise must be known at all times. The nature of noise makes itimpossible to perfectly characterise it. Thus, in practice, even themost sophisticated filters remove genuine signal that is masked by thenoise, as a result of the noise being imperfectly characterised. Usingthese techniques noise can only be removed with any degree of successfrom signals, such as speech signals, where the original signal isknown.

Impulsive noise, such as clicks and crackles, is even more difficult toprocess because it cannot be characterised using dynamic, time resolvedtechniques. There are techniques for correcting the signal. However,problems remain in identifying the noise in the first place. Mostimpulsive noise removal techniques assume that the noise can be detectedby simple measurements such as an amplitude threshold. However, noise isin general unpredictable and can never be identified in all cases by themeasurement of a fixed set of features. It is extremely difficult tocharacterise noise, especially impulsive noise. If the noise is notfingerprinted accurately all attempts at spectral subtraction do notproduce satisfactory results, due to unwanted effects. Even if the noisespectrum is described precisely, the results are dull due in partbecause the spectrum is only accurate at the moment of measurement.

Known impulse noise removal techniques include attenuation, sample andhold, linear interpolation and signal modelling. Signal modelling, asfor example described in “Cedaraudio”, Chandra C, et al, “An efficientmethod for the removal of impulse noise from speech and audio signals”,Proc. IEEE International Symposium on Circuits and Systems, Monterey,Calif., June 1998, pp 206-209, endeavours to replace the corruptedsamples with new samples derived from analysis of adjacent signalregions. In this particular prior art technique, the correction ofimpulsive noise is attempted by constructing a model of the underlyingresonant signal and replacing the noise by synthesised interpolation.However, notwithstanding the need to accurately detect the noise in thefirst place, this approach only works in those cases in which the modelsuits the desired signal and does not itself generate obtrusiveartefacts.

The present invention provides a solution to the problems identifiedabove with respect to noise identification and removal in data derivedfrom an analogue waveform, in particular in audio signals. We have foundthat a technique developed, and described in our copending applicationEP-A-1 126 411, for locating anomalies in images, can be applied to datastreams, in particular to audio signals. Our copending applicationdescribes a system which is able to analyse an image (2-D data) andhighlight the regions that will ‘stand out’ to a human viewer and henceis able to simulate the perception of a human eye looking at objects.

Aspects of the present invention are provided as specified in theappended claims.

The first method of the invention allow for anomaly recognition in adata sequence, which is independent of the particular anomaly. As aspecific example, this method will identify noise in a data sequenceirrespective of the characteristics of the noise.

The present invention provides the advantages that it is not necessaryfor the signal or the anomaly to be characterised for the invention towork. An anomaly is identified by its distinctiveness against anacceptable background rather than through the measurement of specificfeatures. By measuring levels of auditory attention, an anomaly can bedetected. Further, the invention does not rely upon specific featuresand is not limited in the forms of anomalies that can be detected. Theproblem of characterising the anomaly is not encountered using thepresent invention.

Further, the invention does not rely upon specific features and is notlimited in the forms of noise that can be detected. The problem ofcharacterising the noise is not encountered using the present invention.

One method includes the further steps of: identifying ones of saidpositional relationships which give rise to a number of consecutivemismatches which exceeds a threshold, storing a definition of each suchidentified relationship, utilising the stored definitions for theprocessing of further data, and, replacing said identified ones withdata which falls within the threshold. Having accurately identified thenoise segment on the basis of its attention score, this method ensuresthat the noise is replaced by segments of signal that possess low scoresand hence reduces the level of auditor attention in that region. Thus,in contrast to prior art techniques, such as “Cedaraudio”, thispreferred method does not require any signal modelling.

This apparatus of the invention is preferably embodied in a generalpurpose computer, suitably programmed.

The invention also extends to a computer programmed to perform themethods of the invention, and to a computer program product directlyloadable into the internal memory of a digital computer, comprisingsoftware code portions for performing the steps of the method of theinvention, when said product is run on a computer.

This method allows for anomaly recognition in a data array, which isindependent of the particular anomaly. As a specific example, thismethod will identify an anomaly in a data array irrespective of thecharacteristics of the noise.

In order that the invention may be more fully understood embodimentsthereof will now be described by way of example only, with reference tothe figures, in which

FIG. 1 is a flowchart which illustrates schematically the operation ofan embodiment of the invention;

FIG. 2 is a flowchart which illustrates schematically the operation of afurther embodiment of the invention;

FIG. 3 is a flowchart which illustrates schematically the operation of ayet further embodiment of the invention;

FIG. 4 illustrates schematically the basic components of a generalpurpose computer capable of performing the invention;

FIG. 5 shows an example of a comparison between original sample, x0 andrandom reference sample, y0;

FIG. 8 shows an example of the “hill climbing” embodiment of the presentinvention;

FIG. 6 shows the failure of a static threshold;

FIG. 7 shows a static threshold vs a dynamic threshold;

FIG. 9 shows Result 1;

FIG. 10 shows Result 2;

FIG. 11 shows Result 3;

FIG. 12 shows Result 4;

FIG. 13 shows Result 5;

FIG. 14 shows Result 6;

FIG. 15 shows Result 7;

FIG. 16 shows an example of how the error correction algorithmidentifies a high anomaly score region;

FIG. 17 shows an example of how the error correction algorithm createscounters;

FIG. 18 shows an example of how the error correction algorithm carriesout the comparison and logging process;

FIG. 19 shows an example of how the error correction algorithm moves aneighbourhood during error correction;

FIG. 20 is a flow chart depicting the steps of shape learning errorcorrection;

FIG. 21 shows Result 8.

FIG. 22 is a flowchart which illustrates schematically the operation ofan embodiment of the invention;

FIG. 23 illustrates schematically the basic components of a generalpurpose computer capable of performing the invention;

FIG. 24 shows an example of a waveform with cycles;

FIG. 25 shows area definitions of the cycles;

FIG. 26 shows an example of padding a cycle;

FIG. 27 shows the Measure of Difference using a first denominator—theLarger Area Of Two Cycles;

FIG. 28 shows the Measure of Difference using a second denominator—|MaxArea-MinArea|,

FIG. 29 shows Result 1 a;

FIG. 30 shows Result 2 a;

FIG. 31 shows Result 3 a;

FIG. 32 shows Result 4 a;

FIG. 33 shows Result 5 a;

FIG. 34 shows Result 6 a;

FIG. 35 shows Result 7 a;

FIG. 36 shows Result 8 a;

FIG. 37 shows Result 9 a;

FIG. 38 shows Result 10 a;

FIG. 39 shows cutting erroneous cycles;

FIG. 40 shows replacing erroneous cycles.

The ordered sequence of elements which form the data is represented inan array derived from an analogue waveform. Although the data may be afunction of more than ne variable, in this invention the data is“viewed” or ordered in dependence on one variable. Thus, the data can bestored as an array. The array is a one dimensional array, a 1 xn matrix.Data in a one dimensional array is also referred hereinbelow as onedimensional data. The values of the data contained in the array may be asequence of binary values, such as an array of digital samples of anaudio signal. One example of the anomaly recognition procedure isdescribed below in connection with FIGS. 1-8, where the neighbouringelements of x_(o) are selected to be within some one-dimensional,distance of x_(o). (Distance between two elements or sample points inthis example may be the number of elements between these points).

Detection of anomalies in data represented in a one-dimensional array(eg: time resolved data or audio data or data from an acoustic source)concerns instructing a computer to identify and detect irregularities inthe array in which the set of data is arranged. There are variousreasons why a particular region can be considered as ‘irregular’ or‘odd’. It could be due to its odd shape or values when compared with thepopulation data (the remainder of the data); it could be due tomisplacement of a certain pattern in a set of ordered pattern. Put moresimply, an anomaly or irregularity, is any region which is considereddifferent to the rest of the data due to its low occurrence within thedata: that is, anomalous data will have one or more characteristicswhich are not the same as those of the majority of the data.

In the specific examples given in the description of the invention, thealgorithm is tested mainly on audio data with the discrete samples asthe one-dimensional data. However, the invention is limited in no way toaudio data and may include other data that can be represented in a onedimensional array derived from a waveform having a plurality of cycles.

The software which, when run on a computer implements the presentinvention, “One Dimensional Anomaly Detector”, is written in Curllanguage using Curl Surge Lab IDE beta 5-Build: 1.6.0release/englewood/0-1237: copyright© 1998-2001 and may not be compatiblewith future releases of Curl. The results shown in this description wereproduced by the software mentioned above. Again, however, the inventionis not limited to software written using this particular language andmay be implemented using other computer languages.

This algorithm of the present invention works on the basis of analysingsamples. A further algorithm described later as the “cycle comparisonalgorithm” compares cycles defined by certain zero crossings.

The method for the sample analysis algorithm will now be described withreference to FIGS. 1 to 8.

The components shown in FIG. 4 include a data source 20 and a signalprocessor 21 for processing the data. The data is either generated orpre-processed using Cool Edit Pro—version 1.2: Cool Edit Pro iscopyrighted© 1997-1998 by Syntrillium software Corporation. Portions ofCool Edit Pro are copyrighted © 1997, Massachusetts Institute ofTechnology. The invention is not limited in this respect, however, andis suitable for data generated or preprocessed using other techniques.FIG. 4 also shows a normaliser 22. The data is normalised by dividingall values by the maximum modulus value of the data so that the possiblevalues of the data range from −1 to 1.

A central processing unit (CPU) 24, an output unit 27 such as a visualdisplay unit (VDU) or printer, a memory 25 and a calculation processor26. The memory 25 includes stores 250, 254-256, registers 251, 257-259and a mismatch counter 253 and a comparison counter 252. The data andthe programs for controlling the computer are stored in the memory 25.The CPU 24 controls the functioning of the computer using thisinformation.

With further reference to FIGS. 1-5, a data stream to be analysed isreceived at the input means 23 and stored in a digital form in a datastore 250, as a one dimensional array, where each datum or data elementhas a value attributed to it.

An original sample of data, x0, (a reference test element) is selected(step 1) from the one dimensional array, and its value is stored in anoriginal sample register 251. A mismatch count, cx, stored in a mismatchcounter 253, and a count of the number of data comparisons, Ix, storedin a comparison counter 252, are both set to zero (step 2).

Then a random neighbourhood, x1, x2, x3, (test elements) which comprisesa number of data in the vicinity of the original sample (reference testelement), x0, of a certain size (PARAMETER: neighbourhood size) isselected from neighbouring samples (step 5). The neighbourhood is chosento lie within a particular range (or “neighbourhood range”) (PARAMETER:radius) from the original sample, x0.

Then, a second reference sample, y0, is randomly chosen anywhere withina certain domain or range (PARAMETER: comparison domain) in the set ofdata (step 6). The neighbourhood, (i.e. test elements) x1, x2, x3selected around the original sample, x0 together with the originalsample, x0, have a certain configuration which makes a ‘pattern’.

The neighbourhood, y1, y2, y3, (comparison elements) selected around therandom reference sample, (the reference comparison element) y0, togetherwith the reference sample, y0, are chosen to have the sameconfiguration, or pattern, as the neighbourhood around the originalsample.

In the embodiments shown in FIGS. 1 and 3A and 3B, the values of thedata in the original sample ‘pattern’ (test group), x0, x1, x2, x3 arethen compared by calculation processor 26, with the values of the datain the reference sample ‘pattern’ (comparison group), y0, y1, y2, y3,defined by the reference sample together with its neighbouring samples(step 8). If the absolute value of the difference, |x0-y0|, |x1-y1|,etc, between two respective samples or elements is more than a certainthreshold (PARAMETER: threshold), then it is considered as being‘different’. If one or more samples in the original sample pattern aredifferent from the reference sample pattern, then it is said that amismatch occurred. The choice of the threshold can optionally be varied,and may depend on the range of values within the set of data. In theembodiment shown in FIG. 2, this part of the algorithm is carried outaccording to similar principles but different values are compared. Thisis described below in more detail with reference to FIGS. 2 and 6.

In all other respects, however, the algorithm shown in FIG. 2 is thesame as those shown in FIGS. 1 and 3A and 3B.

Further, with reference to FIGS. 1-5, when a mismatch occurs, themismatch counter, cx, for the original sample, x0, is incremented (step10). In this case the neighbourhood (test group) around the originalsample (reference test element) is kept, i.e., the original samplepattern is kept, and the program returns to step 6 to choose anotherrandom 2^(nd) reference sample, y0, for the same comparison process.

When a match occurs the mismatch counter, cx, is not increased. Theprogram returns to step 5 which creates a new neighbourhood around theoriginal sample, whose configuration has a new pattern, before moving onto choose another random 2^(nd) reference sample (step 7) for thecomparison step (step 8).

For each original sample, x0, a certain number of comparisons, L, aremade which result in a certain number of mismatches and matches. Thetotal number of mismatches plus matches is equal to the number ofcomparisons (step 11 and step 14). The number of comparisons can bevaried and will depend on the data to be analysed and the processingpower available. Also, the greater the number of comparisons, thegreater the accuracy of the anomaly detection.

Once the comparison step (step 8) has been done the certain number oftimes, L, the program returns to step 1 to select a different originalsample, x0 and the mismatch counter value, cx, and the number ofcomparisons, L, is output for original sample, x0 (step 15).

Whether the original sample or reference test element, x0, is judged tobe an anomaly will depend on the number of mismatches in comparison tothe number of comparisons, L. The normalised anomaly scores for eachoriginal sample, x0, are obtained by dividing the mismatch counter, cx,for each sample, x0, by the number of comparisons, L, which is alsoequal to the maximum mismatch count, so that the anomaly score rangesfrom zero to one, with zero being 0% mismatch and one being maximummismatch.

FIG. 5 shows an example of a one-dimensional data with each boxrepresenting a sample. Sample marked ‘x’ is the original sample andsample marked ‘y’ is the randomly chosen reference sample. The samples,x1, x2, x3, are the neighbourhood samples whose configuration make upthe original sample pattern. In the example shown in FIG. 5, the radius(or neighbourhood range) is equal to 3, the neighbourhood size is equalto 3 and the comparison domain is equal to the region where y is chosen.A mismatch occurs if |xn-yn|>threshold, where, n, the neighbourhood sizetakes a value from 1 to 3.

As shown in FIG. 5, the first sample which could be scored is the samplewith a distance ‘radius’ away from the start and the last sample to bescored is the sample with a distance ‘radius’ away from the end.

By way of further explanation of the above example of comparison, anumerical example is set out in Table 1. TABLE 1 Example of Comparison(normalizd) (normalizd) Thresh- Sample Value of Value of old Value ofIndex, n X_(n) Y_(n) value |Y_(n) − X_(n)| Mismatch? 0 0.75 0.70 0.20.05 No 1 −0.90 −0.71 0.2 0.19 No 2 0.01 0.34 0.2 0.33 YES 3 0.23 0.450.2 0.22 YES

In the examples given, two of the samples mismatch. As long as one ormore samples in the neighbourhood mismatches, the mismatch counter forthe original, in this example, X₀, will be incremented by one.

With reference to FIGS. 2 and 6, the inventor has noticed that when thewaveform becomes complex or the sampling rate is increased the number ofmismatches increases relative to the number of matches. This causes thescores to become saturated. As the complexity of the waveform increasesthe probability of picking a random reference Y sample that matches theoriginal sample X decreases. Similarly, as the sampling rate isincreased, the probability of finding a match decreases. The increasedprobability of having a mismatch causes saturation of the scores.

To alleviate the problem of score saturation, a ‘hill climbing’ strategyhas been developed to improve the likelihood of a match. The strategy iscalled “hill climbing” because when a mismatch is found, the waveform is“climbed” in both directions along the ordered set of data elementsuntil a match is found.

FIG. 2 is a flow diagram showing the steps an algorithm including the“hill climbing” process and how they fit in with the steps of the sampleanalysis algorithm described above. The hill climbing process is shownwithin the dotted line 20. It is seen in FIG. 2 that the ‘hill climbing’process includes some additional steps to the sample analysis algorithmshown in FIG. 1.

The “hill climbing” process is explained with reference to FIGS. 2 and6. First the original sample, marked X, is chosen (step 1). Theneighbourhood samples, coloured medium dark grey in FIG. 8 and shown inthe neighbourhood of the original sample X, are then selected eitherrandomly (step 5) or reused from the previous comparison if a mismatchoccurred previously (refer to step 6). In the example shown in FIG. 8,the neighbourhood size (parameter: neighbourhood size) is three, hencethree neighbouring samples are selected. And the furthest distance fromwhich a neighbouring sample can be selected is the radius(parameter:radius), which is equal to four in the example in FIG. 8.These samples make up the original “pattern” (step 5).

Next, a reference sample, marked Y, is randomly chosen from anywhere inthe data within a certain domain (step 6) (parameter:comparison domain,not shown in FIG. 8, but shown for example, in FIG. 5).

Then the reference sample, Y, is compared with the original sample, X(step 22). It is determined whether the is a mismatch between thereference sample and original sample (step 24). In the example shown inFIG. 8, the reference sample Y lies outside the threshold(parameter:threshold) region of the original sample X, hence it does notmatch the original sample X. Therefore, in the case of this mismatch thenext step (steps 26, 28, 30 and 32) is to ‘hill climb’ the referencesample by searching the samples within a search radius around Y for asample that matches with the original sample X. This searching is doneone sample at a time in both directions along the one dimensional array(step 30).

In FIG. 8 the sample marked A is the first sample near sample Y thatmatches the original sample X as it falls within the threshold region.Next, the neighbourhood samples of X(coloured medium dark grey) arecompared with the corresponding neighbourhood samples of A (step 28). Ifthey match (step 32), then the mismatch counter is not increased and theprocess is continued with the next comparison by selecting anotherrandom reference sample (step 6). In the example shown in FIG. 8, thecorresponding neighbourhood samples X and A do not match (step 32), butinspite of this and in contrast to the steps shown in FIG. 1, themismatch counter for sample X is not increased.

Instead of increasing the mismatch counter, the ‘hill climbing’ processis continued as described above. Eventually, sample marked B is selectedand found to match the original sample X. Then the neighbourhood samplesof X(coloured medium dark grey) are compared with the correspondingneighbourhood samples of B (step 28).

If they match one another, then the next comparison is continued with byselecting another random reference sample (step 6). In the example shownin FIG. 8 they do match, so the mismatch counter is not increased, andthe process is continued with the next comparison by selecting anotherrandom reference sample. It can be seen by reference to FIG. 8 and theexplanation above, the ‘hill climbing’ process stops when one of twothings happen. The process stops when the algorithm finds a matching“pattern”. Alternatively, the other way the ‘hill climbing’ processstops is when the algorithm fails to find any matching “pattern” withina certain search radius for the ‘hill climbing’ (illustrated in FIG. 8).The radius being set to be equal to the radius of the original sampleX's neighbourhood (parameter:radius). The algorithm searches all sampleswithin the search radius (step 26). When the algorithm fails to find anymatching “pattern” in the neighbourhood, then the mismatch counter fororiginal sample X is increased (step 10).

Therefore, the mismatch counter for the original sample only increaseswhen there is no matching pattern within the ‘hill climbing’ searchradius from the randomly selected reference sample. By only increasingthe mismatch counter when there are no matching “patterns” in theneighbourhood of the reference sample, the constraints imposed on thesearch for a match are relaxed. Thus, the probability of finding a matchare increased. This process is successful in eliminating the problem ofsaturation of the scores observed by the inventors. Reference is made toFIGS. 10 to 15 which show the results achieved.

With reference to FIG. 6, the inventor has found, that in addition tothe problem of saturation another problem exists. Due to the effects ofconstant sampling rate, samples which lie on a larger gradient are moredistant apart compared to samples which lie on a small gradient.

This is because a constant sampling rate means samples are taken atequal intervals of time. When the waveform changes rapidly, i.e. has alarge magnitude of gradient, the difference between two subsequentsample values is therefore large. When the waveform has a smallgradient, there is only a slight difference between two subsequentsample values. See FIG. 6 for illustration.

The effect of a static threshold or mismatch criterion while comparingsamples is as follows: samples which lie on the larger gradient will bediscriminated and have high mismatch scores as they are less likely tomatch with their neighbours. This will result in an artificially highmismatch score for data lying on a steep gradient. Similarly, data lyingon a shallow gradient will score too low.

The inventor has found that this detrimental effect can be removed byusing a dynamic threshold, which takes into account the local gradientof the samples. The dynamic threshold is an adaptive variable thresholdthat is dependent on the sample's local gradient.

The dynamic threshold may be defined as:${DynamicThreshold} = {\frac{LocalGradient}{2} + {StaticThreshold}}$

In sampling an analogue waveform (see FIG. 2) discrete samples are takenover equal time intervals. Each sample acts as a representative for theparticular interval. In this interval the waveform however assumesdifferent values. The local gradient can be defined as the differencebetween the boundary values of the interval and is a measure of thevariation in the interval (the intervals will be chosen smaller than anyperiodicity of the waveform). In this way, the sample interval is set tohave a non-dimensional value of 1. By defining a dynamic threshold whichincreases with increasing local gradient, for example by adding a termproportional to the gradient as above to a static threshold value, themismatch criterion is increased for steeper gradients and sampled valuesmay thus differ more before they mismatch. For small gradients, samplesare mismatched if they differ by a smaller threshold amount.

The mismatch criterion or threshold is thus adaptive to the particularenvironment of a sample. (PARAMETER: threshold). The static thresholdcan be determined to suit the particular data and sensitivity required.Similarly, the particular form of the gradient responsive term may varyaccording to the sampled data and could be determined empirically.(Obtaining a dynamic threshold is optional, and a static threshold ispossible instead).

In FIG. 7, the upper spectrum shows the result with striations due todiscrimination on large slopes using the static threshold while thespectrum below shows a more uniform attention score as a result ofdynamic thresholding.

In the above example, the data comprises an analogue waveform which issampled at regular intervals, although it will be appreciated that theintervals need not be regular.

FIG. 2 shows the steps taken in the case where an analogue waveform issampled, and includes the step 3 of determining the gradient at theoriginal sample, x0, and step 4 of determining the dynamic threshold. Instep 8, the corresponding neighbourhood samples are compared with thedynamic threshold.

FIG. 3 shows the steps taken in the case of an array of digital data,and includes step 16 of determining the values of samples neighbouringthe original sample, and step 17 determining, the dynamic threshold. Instep 8, as for the case of an analogue waveform, the correspondingneighbourhood samples are compared with the dynamic threshold.

The gradient determination step and the step of determining the valuesof samples neighbouring the original sample are carried out by thecalculation processor 26, and the values determined are stored in theregister 259, where they are accessible as the dynamic threshold valuefor use in the comparison step (step 8).

Both the “hill climbing” process and the dynamic threshold process maybe implemented independently to one another as shown in FIGS. 2, 3A and3B. Alternatively, they may be implemented in combination with eachother. In particular, the “hill climbing” process described above withreference to FIGS. 2 and 6 is suitable for combination with either ofthe dynamic threshold embodiments shown in FIGS. 3A and 38.

FIGS. 9 to 15 show Results 1 to 7, respectively. The results shown inthese Figures are produced after the implementation to the sampleanalysis algorithm described with reference to FIGS. 1 and 5 of acombination of the “hill climbing” shown in FIGS. 2 and 6 and thedynamic threshold processes shown in FIGS. 3A and 3B described above.

The results show good anomaly discrimination with no saturation.

The comparison domain for these results is the entire data length. Theresults show in the lower part of the diagram the input data foranalysis. The upper portion of the diagram shows the mismatch scoresachieved for each sample using the sample analysis algorithm plus the“hill climbing” and dynamic threshold modifications. In the upperportion, an anomaly is identified as being those portions having thehighest mismatch scores.

The results shown are for audio signals. However, the present inventionmay also be applied to any ordered set of data elements. The values ofthe data may be single values or may be multi-element values.

Result 1 shown in FIG. 9 shows a data stream of 500 elements having abinary sequence of zeros and ones. The anomaly to be detected is a onebit error at both ends of the data. In this example, the number ofcomparisons was 500, the radius was equal to 5, the neighbourhood sizewas equal to 4 and the threshold was equal to zero. The peaks in theupper portion of the graph show a perfect discrimination of the one biterrors at either end of the datane array.

Result 2 shown in FIG. 10 shows data stream having the form of a sinewave with a change in amplitude. In this example, the number ofcomparisons was 500. The radius was equal to 5, the neighbourhood sizewas equal to 4 and the threshold was equal to 0.01. The peaks in theupper portion of the graph show a perfect discrimination of the anomaly.The highest mismatch scores being for those portions of the data streamwhere the rate of change of amplitude is the greatest.

Result 3 shown in FIG. 11 shows a data stream having the form of a sinewave with background noise and burst and delay error. In this example,the number of comparisons was 500, the neighbourhood size was equal to 4and the threshold was equal to 0.15. The peaks in the upper portion ofthe graph show a good discrimination of the anomalies present.

Result 4 shown in FIG. 12 shows a data stream having the form of a 440kHz sine wave that has been clipped. The data has been sampled at a rateof 22 kHz. In this example, the number of comparisons was 1000, theradius was equal to 75, the neighbourhood size was equal to 4 and thethreshold was equal to 0.15. The peaks show a good discrimination of theanomalies. Further, it is commented that the gaps in between the peakscan be eliminated by selecting a larger neighbourhood size.

Result 5 shown in FIG. 13 shows a data stream having the form of a 440kHz sine wave that has been clipped. The data has been sampled at a rateof 11 kHz. In this example, the number of comparisons was 1000, theradius was equal to 10, the neighbourhood size was equal to 5 and thethreshold was equal to 0.15. The peaks show a good discrimination of theanomalies.

Result 6 shown in FIG. 14 shows a data stream having the form of a 440kHz sine wave including phase shifts. The data has been sampled at arate of 44 kHz. In this example, the number of comparisons was 1000, theradius was equal to 50, the neighbourhood size was equal to 4 and thethreshold was equal to 0.1. The peaks show good discrimination of theanomalies.

Result 7 shown in FIG. 15 shows a data stream having the form of a 440kHz sine wave including phase shifts. The data has been sampled at arate of 44 kHz. In this example, the number of comparisons was 1000, theradius was equal to 50, the neighbourhood size was equal to 4 and thethreshold was equal to 0.1. The peaks show near perfect discriminationof the anomalies.

An error correction system is now described with reference to FIGS.16-20, which has application to the present invention. Having used theanomaly detection system previously described to identify regions ofanomaly in a waveform, error correction is provided to remove thedetected errors. From the attention map produced as described above, asuitable filter coefficient is set (PARAMETER: filter coefficient) sothat only the anomalous region remains in the map before passing thedata to an error correction algorithm.

The error correction algorithm used depends on the algorithm used todetect the anomaly. For example, a cycle comparison detection algorithmis described further below which is for use together with a cutting andreplacing correction algorithm. It has been found that a shape learningerror correction algorithm yields better results with the anomalydetection algorithm described above in this application. The shapelearning algorithm is described below.

The shape learning error correction described below may be implementeddirectly. The success of the error correction however, is dependentprimarily on being able to pinpoint the anomaly with confidence, whichis the function of the detection algorithm.

The error correction method described below deals with the error bytaking a closer look at what is happening when the detection algorithmdoes the comparison described above. FIG. 16 shows that due to thenature of the detection algorithm, the first and last samples in a highscore region are not amongst the erroneous samples. The first sample andlast sample that have high score are a distance of ‘radius’ (PARAMETER:radius) away from the first and last erroneous sample. This is becausethe first neighbourhood that may select the erroneous sample as one ofthe neighbourhood samples normally lies a distance ‘radius’ away.

To explain the details of how the algorithm works the example given inFIG. 16 is referred to. A region of anomaly is indicated with highscores but the actual samples that are erroneous have lower scores thanthe indicated samples. The algorithm does the error correction routinestarting from the left-hand side towards the right-hand side. First, asshown in FIG. 17, it takes the first sample from the left with a highscore and creates two counters for each sample within the radius of thefirst sample.

All samples, X0 to Xs, are then compared with other parts of the data.This comparison method is similar to the detection algorithm and usesthe two parameters from the detection algorithm, which are the number ofcomparisons (PARAMETER: number of comparisons) and the static thresholdvalue (PARAMETER: threshold). X is considered as the original sample.This comparison method uses the dynamic thresholding that is used in thedetection algorithm described above.

For each comparison of the neighbourhood, X₀ to X₆, with other parts ofthe data, if the number of samples in the neighbourhood that mismatchesis less than or equal to a value called ‘range’ then certain informationwill be logged in the counters for those samples that mismatch, refer toFIG. 18. The value ‘range’ is given by the parameter “proportion to fixat one go” (PARAMETER: proportion to fix at one go) multiplied by the‘radius’ (PARAMETER: radius) rounded to the nearest integer. Theparameter proportion to fix at one go can take a value between 0 and 1.Hence the value ‘range’ takes a minimum value of 1 and maximum value of‘radius’.

Two examples are given in FIG. 18. When X and Y is compared, only onesample mismatches, which is less than the value of ‘range’. So, the‘mismatch frequency’ counter is increased for the sample(s) thatmismatch and the ‘total mismatch value’ counter is also updated byadding it with the value of the difference between X and Y (the mismatchvalue). However, when X and Z is compared, four samples mismatch, whichis more than the value of ‘range’. If this happens, no information islogged. The counter values are not altered.

At the end of the comparison process, the ‘mismatch frequency’ counterholds the value indicating how often each of the samples X₀ to X₆mismatches, and the ‘total mismatch value’ counter holds the sum of allthe mismatch difference values that have occurred for each of thesamples X₀ to X₆. From these two pieces of information, we can nowdecide which sample(s) are always causing a mismatch and how much toadjust them so that they will match more often. This can be done byfirst getting a mean value for the mismatch frequencies of all thesamples. Then any sample(s) that have a larger mismatch frequency thanthe mean value will be considered needing adjustment. The amount toadjust each sample is given by the average value of the mismatch values.This average value is obtained by dividing the value in the ‘totalmismatch value’ counter by the value in the ‘mismatch frequency’ counterof the sample(s) that need to be adjusted.

The sample(s) are then adjusted and the new attention score for thesample X₀ is obtained using the standard detection algorithm. If the newattention score is less than the previous score, the adjustments arekept, otherwise the adjustments are discarded. The algorithm repeats theprocess again for neighbourhood Xn and does the adjustments again aslong as the attention score for X₀ decreases. If the attention score forX₀ does not decrease after a certain number of times (PARAMETER: numberof tries to improve score) consecutively, the algorithm moves on thenext sample to be chosen as the original sample. The next sample to bechosen lies ‘range’ number of samples to the right of the previousoriginal sample. FIG. 19 illustrates how the algorithm uses the ‘range’value as described above.

As shown in FIG. 19, for each new step the algorithm takes, the neworiginal sample X₀ lies ‘range’ samples in front of the previousoriginal sample. This also means that the new neighbourhood will contain‘range’ number of erroneous samples, assuming that all the errors in theprevious neighbourhood are corrected perfectly. Because of this, whenthe neighbourhood is compared to an identical reference neighbourhoodelsewhere in the data, it is expected that only ‘range’ samples tomismatch while the rest of the samples should match. If more than‘range’ samples mismatch, this means that the good samples are alsomismatching, hence the reference neighbourhood that it compared with isunlikely to be identical to the original neighbourhood and therefore noinformation at all is logged.

The algorithm is called shape learning because it tries to makeadjustments to the erroneous samples so that the overall shape orrecurring pattern of the waveform is preserved. As the total number ofsamples is the same before and after the error correction, the algorithmworks fine if the error is not best fixed by inserting or removingsamples. If this is the case, then the algorithm will propagate theerror along the waveform. This is due to the error correction routinewhich starts from the left of the ‘high score’ region and adjusts thesamples towards the right. FIG. 21, Result 8 shows a good example of thephase shift error described above. In FIG. 21, the lower part of thediagram shows the input data for analysis. The upper portion of thediagram shows the results of the analysis where the y axis in the upperportion shows the mismatch value. In the upper portion, an anomaly isidentified as being those (lighter) portions having the greatestmismatch values.

It is noted that Result 8 is shown to illustrate the phase shift. Theerror recognition has been achieved not using the algorithm described inthis application, but using the cycle comparison algorithm describedfurther below.

FIG. 20 shows a flow chart outlining the steps of the shape learningerror correction described above.

Firstly, the first “high score” original sample, X, and itsneighbourhood are obtained, step 100. Next, counters are created foreach of the samples in the neighbourhood, step 102. A random referencesample and its neighbourhood are also selected, step 104. Having donethis, the entire neighbourhood is compared, step 106, and it isdetermined whether more than the “range” of samples mismatch. If theanswer is “yes”, the comparison counter is increased, step 114, and thealgorithm returns to step 104 to select a random reference sample andits neighbourhood. If the answer is “no”, the next step is to obtain thedifference, the mismatch value, dn, for the sample or samples thatmismatch, step 108. Then the mismatch frequency counter is increased andthe mismatch value, dn is added to the mismatch value counter for thesample or samples that mismatch, step 110.

Next, it is determined whether the comparison counter is equal to thenumber of comparisons, step 112. If the answer is “no” the algorithmreturns to step 114, and the comparison counter is increased before thealgorithm returns to step 104 to select a random reference sample andits neighbourhood. If the answer is “yes”, the mean of the mismatchfrequency counters is obtained, step 116. Subsequently, the sample orsamples whose mismatch frequency counter is more than the calculatedmean in step 116, are identified, step 118. The identified sample orsamples are adjusted by their average mismatch value, step 120. Havingdone this, a new attention (mismatch) score is obtained for the originalsample using the sample analysis detection algorithm described above,step 122. The new attention (mismatch) score is compared with the old(first) attention score, step 124. If it is lower than the old score,the adjustments made are kept and the failed counter is reset. If thenew score is not lower, the adjustments made are discarded and thefailed counter is increase, step 126.

Next, it is determined whether the failed counter is equal to the numberof tries to fix the error, step 130. If the answer is “no”, thealgorithm returns to step 104 to select a random reference sample andits neighbourhood. If the answer is “yes”, the next original sample, X,and it neighbourhood is obtained, step 132, before the algorithm returnsto step 102, to create counters for each of the samples in theneighbourhood.

Depending on the type of error and the original waveform, certainmethods could prove to be more efficient in removing the error. Theshape learning algorithm described above, requires large amounts ofprocessing time due to its looping construct. But nevertheless it is thepreferred way of removing the error as it possesses the ability topredict the shape of the waveform. However, on occasion it propagatescertain errors as it does not alter the total number of samples. Cuttingor replacing as described in our copending unpublished application (IPDreference A30176) proves to be the best method in such cases. Further,it is noted that in any case the performance of the error correction isdependent on the performance of the anomaly detection algorithm.

A detection algorithm of the present invention has been demonstrated tobe very tolerant to the type of input data as well as being veryflexible in spotting anomalies in one-dimensional data. Therefore thereare many applications where such detection method may be useful.

In the audio field, such a detection algorithm may be used as a linemonitor to monitor recordings and playback for unwanted noise as well asbeing able to remove it. It may also be useful in the medical field asan automatic monitor for signals from a cardiogram or encephalogram of apatient. Apart from monitoring human signals, it may also be used tomonitor engine noise. Like monitoring in humans, the output frommachines, be it acoustic signals or electrical signals, deviate from itsnormal operating pattern as the machine's operating conditions vary, andin particular, as the machine approaches failure.

The algorithm may also be applied to seismological or other geologicaldata and data related to the operation of telecommunications systems,such as a log of accesses or attempted accesses to a firewall.

As the detection algorithm is able to give a much earlier warning in thecase of systems that are in the process of failing, in addition tomonitoring and removing errors, it may also be used as a predictor. Thisaspect has application for example, in monitoring and predicting trafficpatterns.

A further embodiment, the referred to as the “cycle comparison” is nowdescribed.

Detection of anomalies in an ordered set of data concerns instructing acomputer to identify and detect irregularities in the set. There arevarious reasons why a particular region can be considered as ‘irregular’or ‘odd’. It could be due to its odd shape or values when compared withthe population data; it could be due to misplacement of a certainpattern in a set of ordered pattern. Put more simply, an anomaly orirregularity, is any region which is considered different due to its lowoccurrence within the data.

In the specific examples given in the description of the invention, thealgorithms are tested mainly on sampled audio data with the discretesamples as the one-dimensional data. However, the invention is limitedin no way to audio data and may include, as mentioned above other data,or generally data obtained from an acoustic source, such as engine noiseor cardiogram data.

This algorithm of the present invention works on the basis ofidentifying and comparing cycles delimited by positive zero crossingsthat occur in the set of data. The inventors have found however, thatthe sample analysis algorithm as described above may start to fail whenthe input waveform becomes too complex. Although the ‘hill climbing’method described above has been implemented, saturation is still occursfor more complex waveforms. Saturation is an effect observed by theinventors when waveforms become complex or the sampling rate isincreased. In these circumstances, the number of mismatches increasesrelative to the number of matches without necessarily indicating ananomaly. As the complexity of the waveform increases the probability ofpicking a random reference Y sample that matches the original sample Xdecreases. Similarly, as the sampling rate is increased, the probabilityof finding a match decreases. The increased probability of having amismatch causes saturation of the scores.

Also, using the “hill climbing” method the processing time required toanalyse a 1s length of audio data sampled at 44 kHz sampling rate uses alot of processing time, requiring up to 220s of processing time on aPII266 MHz machine.

The method for the cycle comparison algorithm will now be described withreference to FIGS. 22 to 28.

The components shown in FIG. 22 include a data source 20 and a signalprocessor 21 for processing the data, a normaliser 22 and an input 23.The data is either generated or pre-processed using Cool EditPro—version 1.2: Cool Edit Pro is copyrighted© 1997-1998 by Syntrilliumsoftware Corporation. Portions of Cool Edit Pro are copyrighted© 1997,Massachusetts Institute of Technology. The invention is not limited inthis respect, however, and is suitable for data generated orpreprocessed using other techniques.

Also shown in FIG. 2 is a central processing unit (CPU) 24, an outputunit 27 such as a visual display unit (VDU) or printer, a memory 25 anda calculation processor 26. The memory 25 includes stores 250, 254-256,registers 251, 257-259 and a mismatch counter 253 and a comparisoncounter 252. The data and the programs for controlling the computer arestored in the memory 25. The CPU 24 controls the functioning of thecomputer using this information.

With reference to FIGS. 22-28 where indicated, a data stream to beanalysed is received at the input means 23. Firstly, the data isnormalised by normaliser 22 by dividing all values by the maximum valueof the data so that the possible values of the data range from −1 to 1.

The normalised data is stored in a digital form in a data store 250, asa one dimensional array, where each datum has a value attributed to it.

Then the algorithm identifies all the positive zero crossings in thewaveform (step 0). A mean DC level adjustment (not shown) may also bemade before the positive zero crossings are identified, to accommodateany unwanted DC biasing.

The positive zero crossings are those samples whose values are closestto zero and if a line were drawn between whose neighbours, the gradientof the line would be positive. For example, of the sequence of elementshaving the following values: −1, −0.5, 0.2, 0.8, 1, 0.7, 0.3, −0.2,−0.9, −0.5, −0.1, 0.4, the positive zero crossings would be 0.2 and−0.1.

FIG. 24 shows a waveform with the positive zero crossings highlighted.

They may not always lie on the zero line due to their sampling position.The samples which is closest to the zero line, in other words have thesmallest absolute value, are always chosen. A full cycle, as shown forexample in FIG. 24, is made up of the samples lying between twoconsecutive positive zero crossings.

In the example shown the cycles are delimited with respect to thepositive zero crossing. However, the cycles are not limited in thisrespect and may be delimited with respect to other criteria, such asnegative zero crossings, peak values, etc. The only limitation is thatpreferably, both the test cycle and the reference cycle are selectedaccording to the same criteria.

With reference to FIG. 22, the next step (step 1) is to choose a cyclebeginning from the start of the data, to be the original cycle, x0. Thevalues of the data of the samples in the original cycle, x0, are storedin the original cycle register 251.

A mismatch count, cx, stored in a mismatch counter 253, and a count ofthe number of data comparisons, Ix, stored in a comparison counter 252,are both set to zero (step 2).

The next step (step 3) is to randomly pick another cycle, y0, elsewherein the waveform, within a certain domain (parameter: comparison domain),to be the comparing reference cycle. Usually, the original cycle and thereference cycle would come from data having the same origin. However,the invention is not limited in this respect. For the cases where thewaveform has a form where the comparison domain may be large, forexample, waveforms, for example derived from a running engine, which donot vary dramatically over time, the algorithm may be used to compare atest cycle from data from one source with a reference cycle from asecond source. For cases, where the comparison domain may not be toolarge, for example, musical data which varies greatly over a shortperiod of time, comparing a test source with a second reference sourceof data may not be so satisfactory. Reference is made to Result 10 ashown in FIG. 38.

Returning to FIG. 22, the test cycle and the comparison cycle are thencompared (steps 4, 5, 6, 7, 8) in order to obtain a mismatch score forthe reference cycle, y0, with respect to the original cycle, x0. As seenin FIGS. 24 and 25, each cycle, x0, y0 includes a plurality of datasamples or elements each having a value, sj, sj′, respectively. Eachvalue having also a respective magnitude.

The comparison of the cycles includes a series of steps and involvesdetermining various quantities derived from the data in the cycles. Thecalculation processor 26 carries out a series of calculations. Thederived quantities are stored in registers 257, 258 and 259. Firstly, anintegration value is obtained for the original cycle and the referencecycle. This, may for example, be the area of the original cycle, sigma|sj|, and the area of the reference cycle, sigma |sj′| (step 4). Withreference to FIG. 25, the area of a cycle is defined by the sum of themagnitudes of the individual samples in the cycle. Due to the definitionof the area, which is the sum of the samples in the cycle, the area ofidentical cycles may vary to a great extent if the sampling rate is lowand the waveform frequency is large. Hence, while using the cyclecomparison algorithm, it is preferable to use at least 11 kHz samplingfrequency for acceptable accuracy and sensitivity.

With reference to FIG. 25, which shows an example, the next step (step5) is to derive a quantity which gives an indication of the extent ofthe difference between the area and the shape of the reference cycle,y0, with respect to the original cycle, x0. This is defined by the sumof the magnitudes of the difference between each of the correspondingsamples in the original cycle and the reference cycle, sigma (¦sj-sj′¦).FIG. 4 shows three graphs. The first graph 40 shows the original cycle,x0, having samples, sj, having values s1 to s14. The area of theoriginal cycle is equal the sum of the magnitudes of the values, s1 tos14: that being sigma |sj|. The second graph 42 shows the referencecycle, y0, having samples, sj′, having values s1′to s14′. The area ofthe reference cycle is equal to the sum of the magnitudes of the values,s1′ to s14′: that being sigma |sj′|. The third graph 44 shows thedifference the cycles as defined by sigma (|sj-sj′|).

The next step (step 6) is to establish whether both cycles have the samenumber of samples, sj, sj′. If the number of samples in the cycles arenot equal, the shorter cycle is padded with samples of value zero untilboth the original and reference cycles contain the same amount ofsamples.

FIG. 5 shows an example of the padding described above with respect tostep 6 shown in FIG. 1. In FIG. 26, cycle 1 has nine samples while cycle2 only has 6 samples. In order to do a comparison, both cycles are madeequal in sample size. This is achieved by padding the cycle having thefewer number of samples. In the example shown in FIG. 26, cycle 2 ispadded with additional samples of value zero until it becomes the samesize as the larger cycle, cycle 1 in this case.

The quantities derived in the steps described above are used todetermine for each comparison of an original cycle with a referencecycle a “measure of difference” (step 8), which is a quantity that showshow different one cycle is from the other.

This empirical ‘measure of difference’ is defined as:${MeasureofDifference} = \frac{AreaDifference}{{LargerAreaOfTwoCycles} + {{{{Max}\quad{Area}} - {{Min}\quad{Area}}}}}$

MaxArea is the largest area of a cycle in the entire comparison domainand MimnArea is the smallest area of a cycle in the entire comparisondomain. LargerAreaOfTwoCycles is the bigger area of the original cycleand the reference cycle.

The inventors have derived the definition of the “measure of difference”as shown above for the following reasons.

With reference to FIG. 27, the first denominator, LargerAreaOfTwoCycles,is neutral to logarithmic increments of the cycle amplitude. This meansthat every time a cycle is compared against another geometricallysimilar cycle which is double its amplitude, the measure of differenceis the same. For example when a sine cycle of amplitude ‘X’ is comparedwith another sine cycle of amplitude ‘2×’, the measure of difference is‘D’. Hence when a sine cycle of amplitude ‘X’ is compared with anothersine cycle of amplitude ‘½ X’, the measure of difference would still be‘D’.

Further, with reference to FIG. 28, the second denominator,|MaxArea−MinArea|, is a normalizing term for the quantity AreaDifferencewhich is neutral to linear increments of the cycle amplitude. This meansthat if the amplitude of a geometrically similar cycle increaseslinearly, when a cycle is compared to the cycle next to itself, eitherleft or right, both comparisons should give the same magnitude in the‘measure of difference’.

Either of these denominators may be chosen. It is not necessary to useboth. However, if either of these denominations are used, it has beenfound that some desirable results as well as some undesirable onesoccur. One of the denominators tends to be more effective on certainwaveforms than the other. Therefore, preferably, a hybrid denominatormade by adding them together is chosen, as this results in a much moregeneral and unbiased ‘measure of difference’ which is effectiveindependent of the waveform.

The derived ‘measure of difference’ is next compared with a thresholdvalue (step 9) to determine whether there is a mismatch. If thecalculated “measure of differences” for the original sample, x0, and thereference sample, y0, more than a certain threshold (PARAMETER:threshold), then it is considered as being ‘different’. The choice ofthe threshold can be varied, and will depend on the range of valueswithin the set of data.

Further, with reference to FIG. 22, when a mismatch occurs, the mismatchcounter, cx, for the original sample, x0, is incremented (step 10). Whena match occurs the mismatch counter, cx, is not increased. The programreturns to step 3 which creates a new random reference cycle, y1, beforemoving on to calculate the quantities described above in steps 4 and 5,and carrying out any necessary padding in step 6, before calculating the“measure of difference” in step 8.

For each original sample, x0, a certain number of comparisons, L, aremade which result in a certain number of mismatches and matches. Thetotal number of mismatches plus matches is equal to the number ofcomparisons (step 11 and step 14). The number of comparisons can bevaried and will depend on the data to be analysed and the processingpower available. Also, the greater the number of comparisons, thegreater the accuracy of the anomaly detection.

Each original cycle, x0, is compared with a certain number of referencesamples, y0. The comparison steps from selecting a reference sample(step 3) to calculating the “measure of difference” (step 8) is carriedout over a certain number of times (parameter:comparisons) Once the“measure of difference” (step 8) has been calculated for the certainnumber of reference samples, yL, and the comparison done the certainnumber of times, L, the program returns to step 1 to select a differentoriginal sample, x1 and the mismatch counter value, cx, and the numberof comparisons, L, is output for original sample, x0 (step 15).

Whether original sample, x0, is judged to be an anomaly will depend onthe number of mismatches in comparison to the number of comparisons, L.The normalised anomaly scores for each original sample, x0, are obtainedby dividing the mismatch counter, cx, for each sample, x0, by the numberof comparisons, L, which is also equal to the maximum mismatch count, sothat the anomaly score ranges from zero to one, with zero being 0%mismatch and one being maximum mismatch.

FIGS. 24 to 39 show results obtained using the cycle comparisonalgorithm. With reference to our copending unpublished patentapplications IPD ref A30114, A30174 and A30175, it is noted that thecycle comparison algorithm does not require parameter radius andparameter neighbourhood size.

The Results show good anomaly discrimination with no saturation.

If the comparison domain is unspecified, it is assumed to be the entiredata length. The results show in the lower part of the diagram the inputdata for analysis. The upper portion of the diagram shows the mismatchscores achieved for each sample using the cycle analysis algorithmdescribed above with reference to FIGS. 22 to 28. In the upper portion,an anomaly is identified as being those portions having the highestmismatch scores.

The results shown are for audio signals. However, the present inventionmay also be applied to any ordered set of data elements. The values ofthe data may be single values or may be multi-element values.

Result 1 a shown in FIG. 29 shows a data stream of 500 elements having abinary sequence of zeros and ones. The anomaly to be detected is a onebit error at both ends of the data. In this example, the number ofcomparisons was 500, and the threshold was equal to 0.1. However, thechoice of the threshold value in this case was not critical. The peaksin the upper portion of the graph show a perfect discrimination of theone bit errors at either end of the data sequence.

Result 2 a shown in FIG. 30 shows data stream having the form of a sinewave with a change in amplitude. In this example, the number ofcomparisons was 250 and the threshold was equal to 0.01. However, thechoice of the threshold value in this case was not critical. The peaksin the upper portion of the graph show a perfect discrimination of theanomaly. The highest mismatch scores being for those portions of thedata stream where the rate of change of amplitude is the greatest.

Result 3 a shown in FIG. 31 shows a data stream having the form of asine wave with background noise and burst and delay error. In thisexample, the number of comparisons was 250, and the threshold was equalto 0.15. The peaks in the upper portion of the graph show a perfectdiscrimination of the anomalous cycles.

Result 4 a shown in FIG. 32 shows a data stream having the form of a 440kHz sine wave that has been clipped. The data has been sampled at a rateof 22 kHz. In this example, the number of comparisons was 250, and thethreshold was equal to 0.15. The peaks show a perfect discrimination ofthe anomalous cycles.

Result 5 a shown in FIG. 33 shows a data stream having the form of a 440kHz sine wave including phase shifts. The data has been sampled at arate of 44 kHz. In this example, the number of comparisons was 250 andthe threshold was equal to 0.15. The peaks show a perfect discriminationof the anomalies.

Result 6 a shown in FIG. 34 shows a data stream having the form of a 440kHz sine wave that has been clipped. The data has been sampled at a rateof 44 kHz. In this example, the number of comparisons was 250, and thethreshold was equal to 0.15. The peaks show a near perfectdiscrimination of the anomalous cycles.

Result 7 a shown in FIG. 35 shows a data stream having the form of a 440kHz sine wave that has been clipped. The data has been sampled at a rateof 11 kHz. In this example, the number of comparisons was 250 and thethreshold was equal to 0.05. In this example, the threshold value iscritical as due to the low sampling rate. As discussed above, forsignals that lie in the audio range, at a frequency of around 440 kHz,the sampling rate is preferably greater than 11 kHz. This is shown inthe Result 6 a. The results are less satisfactory due to the lowsampling rate. However, the algorithm would have performed much betterat a higher sampling rate.

Result 8 a shown in FIG. 36 shows a 440 kHz waveform modulated at 220kHz with a sampling rate of 6 kHz. In this example, the number ofcomparisons was 500 and the threshold was 0.15. The results show thatalthough the average score has increased, score saturation has notoccurred. The algorithm has still identified the anomalous region.

Result 9 a shown in FIG. 37 shows data having a 440 kHz amplitudemodulated sine wave. In this example, the sampling rate was 6 kHz, thenumber of comparisons was 250 and the threshold was 0.15. The resultsshow good discrimination of the anomalous cycles. It is noted that somestriation effects are evident.

Result 10 a shown in FIG. 38 shows real audio data comprising a guitarchord with a burst of noise. In this example, the sampling rate was 11kHz, the number of comparisons was 250 and the threshold was 0.015.Unlike the previous results, the comparison domain was not the entiredata length but was 175 cycles. This was critical due to the morphing ofcycles in this complex waveform. The results show that the noise hasbeen very well identified. It is further notices that the attack anddecay region, where the chord is struck and when it dies away, alsoscore high attention (mismatch) scores, as would be expected.

The above examples show very good results. For many types of waveformthe cycle comparison algorithm described here is favoured over thesample analysis algorithm described with reference to FIGS. 1 to 21.However, it is to be noted that there are some waveforms that may bemore suitable for analysis by the sample analysis algorithm, for examplewhere in a waveform it is not considered anomalous for a small amplitudecycle to be adjacent a large amplitude cycle.

It has been noticed that the cycle comparison algorithm has problemsidentifying a misplaced cycle in a set of ordered cycles. This isbecause as long as the cycle is common in other parts of the waveform,it will not be considered as an anomaly regardless of its position.Thus, preferably, it is advantageous to take more than one cycle intoaccount while doing the comparison. Thus, the original cycle, x0, may bea plurality of cycles. n subsequent cycles, xn, together to do thecomparison or to implement a random neighbourhood of cycles forcomparison in the same way the algorithms described with reference toFIGS. 1 to 21 take a random neighbourhood of samples.

An error correction system is now described with reference to FIGS. 40and 20, which has application to the present invention. Having used theanomaly detection system previously described to identify regions ofanomaly in a waveform, error correction is provided to remove thedetected errors. From the attention map produced as described above, asuitable filter coefficient is set (PARAMETER: filter coefficient) sothat only the anomalous region remains in the map before passing thedata to an error correction algorithm. The data in the attention map isstored in registers.

The error correction algorithm used depends on the algorithm used todetect the anomaly. For the cycle comparison algorithm described aboveis for use together with a cutting and replacing correction algorithm.However, the sample analysis algorithm described above with reference toFIGS. 1 to 21, it has been found that a shape learning error correctionalgorithm yields better results.

The cutting and replacement correction algorithm described below may beimplemented directly. The success of the error correction however, isdependent primarily on being able to pinpoint the anomaly withconfidence, which is the function of the detection algorithm.

FIG. 39 shows the steps taken to perform the cutting cycles routine.This method cuts the erroneous regions away and joins the ends together.This reduces the chances of second order noise.

FIG. 40 shows the steps taken to perform the replacing cycles routing.After the erroneous cycle is identified, the algorithm searches acertain number of cycles (parameter: search radius for replacementcycle) around the erroneous cycle for a cycle with the lowest scoreavailable. It then uses this cycle to replace the erroneous cycle. Aswith cutting cycles method, this method is best implemented if the cyclecomparison algorithm is used for the detection.

A detection algorithm of the present invention has been demonstrated tobe very tolerant to the type of input data as well as being veryflexible in spotting anomalies in one-dimensional data. Therefore thereare many applications where such detection method may be useful.

In the audio field, such a detection algorithm may be used as a linemonitor to monitor recordings and playback for unwanted noise as well asbeing able to remove it. It may also be useful in the medical field asan automatic monitor for signals from a cardiogram or encephalogram of apatient. Apart from monitoring human signals, it may also be used tomonitor engine noise. Like monitoring in humans, the output frommachines, be it acoustic signals or electrical signals, deviate from itsnormal operating pattern as the machine's operating conditions vary, andin particular, as the machine approaches failure.

The algorithm may also be applied to seismological or other geologicaldata and data related to the operation of telecommunications systems,such as a log of accesses or attempted accesses to a firewall.

As the detection algorithm is able to give a much earlier warning in thecase of systems that are in the process of failing, in addition tomonitoring and removing errors, it may also be used as a predictor. Thisaspect has application for example, in monitoring and predicting trafficpatterns.

The invention can be described in generally terms as set out in the setof numbered clauses below:

1. A method of recognising anomalies contained within a set of dataderived from an analogue waveform, the data represented by an orderedsequence of data elements each having a value, in respect of at leastsome of said data elements, including the steps of: selecting a group oftest elements comprising at least two elements of the sequence;selecting a group of comparison elements comprising at least twoelements of the sequence, wherein the comparison group has the samenumber of elements as the test group and wherein the elements of thecomparison group have relative to one another the same positions in thesequence as have the elements of the test group; comparing the value ofeach element of the test group with the value of the correspondinglypositioned element of the comparison group in accordance with apredetermined threshold to produce a decision that the test groupmatches or does not match the comparison group; selecting further saidcomparison groups and comparing them with the test group; generating adistinctiveness measure as a function of the number of comparisons forwhich the comparison indicates a mismatch. 2. A method according toclause 1 including the further step of: identifying ones of saidpositional relationships which give rise to a number of consecutivemismatches which exceeds said threshold. 3. A method according to clause2 including the further steps of: storing a definition of each suchidentified relationship; and utilising the stored definitions for theprocessing of further data. 4. A method according to clause 2 or clause3 including the further step of: replacing said identified ones withdata which falls within the threshold. 5. A method according to anypreceding clause, wherein the time resolved data is an audio signal. 6.A method of removing noise from a sequence of data represented by anordered sequence of data elements each having a value comprising, inrespect of at least some of said data elements, including the steps of:selecting a group of comparison elements comprising at least twoelements of the sequence, wherein the comparison group has the samenumber of elements as the test group and wherein the elements of thecomparison group have relative to one another the same positions in thesequence as have the elements of the test group; comparing the value ofeach element of the test group with the value of the correspondinglypositioned element of the comparison group in accordance with apredetermined match criterion to produce a decision that the test groupmatches or does not match the comparison group; selecting further saidcomparison groups and comparing them with the test group; generating adistinctiveness measure as a function of the number of comparisons forwhich the comparison indicates a mismatch, identifying ones of saidpositional relationships which give rise to a number of consecutivemismatches which exceeds a threshold, and replacing said identified oneswith data which falls within the threshold. 7. A computer programmed toperform the method of any of clauses 1-6. 8. A computer program productdirectly loadable into the internal memory of a digital computer,comprising software code portions for performing the steps of any ofclauses 1-6, when said product is run on a computer. 9. An apparatus forrecognising anomalies contained within a set of data derived from ananalogue waveform, the data represented by an ordered sequence of dataelements each having a value comprising, in respect of at least some ofsaid data elements, including: means for storing an ordered sequence ofdata, each datum having a value, means for selecting a group of testelements comprising at least two elements of the sequence; means forselecting a group of comparison elements comprising at least twoelements of the sequence, wherein the comparison group has the samenumber of elements as the test group and wherein the elements of thecomparison group have relative to one another the same positions in thesequence as have the elements of the test group; means for comparing thevalue of each element of the test group with the value of thecorrespondingly positioned element of the comparison group in accordancewith a predetermined match criterion to produce a decision that the testgroup matches or does not match the comparison group; means forselecting further said comparison groups and comparing them with thetest group; means for generating a distinctiveness measure as a functionof the number of comparisons for which the comparison indicates amismatch. 10. A computer program product stored on a computer usablemedium, comprising: computer readable program means for causing acomputer to store an ordered sequence of data derived from an analoguewaveform, each datum having a value, computer readable program means forcausing a computer to select a group of test elements comprising atleast two elements of the sequence; computer readable program means forcausing a computer to select a group of comparison elements comprisingat least two elements of the sequence, wherein the comparison group hasthe same number of elements as the test group and wherein the elementsof the comparison group have relative to one another the same positionsin the sequence as have the elements of the test group; computerreadable program means for causing a computer to compare the value ofeach element of the test group with the value of the correspondinglypositioned element of the comparison group in accordance with apredetermined match criterion to produce a decision that the test groupmatches or does not match the comparison group; computer readableprogram means for causing a computer to select further said comparisongroups and comparing them with the test group; computer readable programmeans for causing a computer to generate a distinctiveness measure as afunction of the number of comparisons for which the comparison indicatesa mismatch. 11. A method of recognising anomalies in data represented byan ordered array of data elements each having a value, in respect of atleast some of said data elements, including the steps of: selecting agroup of test elements comprising at least two elements of the array;selecting a group of comparison elements comprising at least twoelements of the array, wherein the comparison group has the same numberof elements as the test group and wherein the elements of the comparisongroup have relative to one another the same positions in the array ashave the elements of the test group; comparing the value of each elementof the test group with the value of the correspondingly positionedelement of the comparison group in accordance with a dynamic threshold,whose value varies in accordance with the values of the elements aroundat least one of said test elements, to produce a decision that the testgroup matches or does not match the comparison group; selecting furthersaid comparison groups and comparing them with the test group;generating a distinctiveness measure as a function of the number ofcomparisons for which the comparison indicates a mismatch. 12. A methodaccording to clause 1, including the further step of: determining thelocal gradient at one of said test elements. 13. A method according toclause 2, including the further step of: using said local gradient todetermine the dynamic threshold. 14. A method according to any of thepreceding clauses wherein the dynamic threshold is determined inaccordance with the local gradient and a predetermined threshold. 15. Amethod according to clause 1, including the further step of: determiningthe value of the elements neighbouring one of said test elements. 16. Amethod according to clause 6, wherein the dynamic threshold isdetermined in accordance with said value of the elements neighbouringone of said test elements. 17. A method according to clause 1 includingthe further step of: identifying ones of said positional relationshipswhich give rise to a number of consecutive mismatches which exceeds saidthreshold. 18. A method according to clause 7 including the furthersteps of: storing a definition of each such identified relationship; andutilising the stored definitions for the processing of further data. 19.A method according to clause 7 or clause 8 including the further stepof: replacing said identified ones with data which falls within thethreshold. 20. A computer programmed to perform the method of any ofclauses 11-19. 21. A computer program product directly loadable into theinternal memory of a digital computer, comprising software code portionsfor performing the steps of any of clauses 11-19, when said product isrun on a computer. 22. An apparatus for recognising anomalies in datarepresented by an ordered array of data elements each having a value, inrespect of at least some of said data elements, including: means forstoring an ordered array of data, each datum having a value, means forselecting a group of test elements comprising at least two elements ofthe array; means for selecting a group of comparison elements comprisingat least two elements of the array, wherein the comparison group has thesame number of elements as the test group and wherein the elements ofthe comparison group have relative to one another the same positions inthe array as have the elements of the test group; means for comparingthe value of each element of the test group with the value of thecorrespondingly positioned element of the comparison group in accordancewith a dynamic threshold to produce a decision that the test groupmatches or does not match the comparison group; means for selectingfurther said comparison groups and comparing them with the test group;means for generating a distinctiveness measure as a function of thenumber of comparisons for which the comparison indicates a mismatch. 23.An apparatus according to clause 22, including means for determining thelocal gradient at one of said test elements. 24. An apparatus accordingto clause 23, including means for determining the dynamic thresholdusing said local gradient. 25. An apparatus according to any of clauses22-24, wherein dynamic threshold is determined in accordance with thelocal gradient and a predetermined threshold. 26. An apparatus accordingto clause 22 including means for determining the value of the elementsneighbouring one of said test elements. 27. An apparatus according toclause 26, wherein the dynamic threshold is determined in accordancewith said value of the elements neighbouring one of said test elements.28. An apparatus according to clause 22 including means for identifyingones of said positional relationships which give rise to a number ofconsecutive mismatches which exceeds said threshold. 29. An apparatusaccording to clause 28 including means for storing a definition of eachsuch identified relationship; and utilising the stored definitions forthe processing of further data. 30. An apparatus according to clause 28or 29 including means for replacing said identified ones with data whichfalls within the threshold. 31. A computer program product stored on acomputer usable medium, comprising: computer readable program means forcausing a computer to store an ordered array of data, each datum havinga value, computer readable program means for causing a array; computerreadable program means for causing a computer to select a group ofcomparison elements comprising at least two elements of the array,wherein the comparison group has the same number of elements as the testgroup and wherein the elements of the comparison group have relative toone another the same positions in the array as have the elements of thetest group; computer readable program means for causing a computer tocompare the value of each element of the test group with the value ofthe correspondingly positioned element of the comparison group inaccordance with a dynamic threshold to produce a decision that the testgroup matches or does not match the comparison group; computer readableprogram means for causing a computer to select further said comparisongroups and comparing them with the test group; computer readable programmeans for causing a computer to generate a distinctiveness measure as afunction of the number of comparisons for which the comparison indicatesa mismatch. 32. A method of recognising anomalies in data represented byan ordered array of data elements each having a value, in respect of atleast some of said data elements, including the steps of: i) selecting afirst test element from said array, ii) selecting a random referenceelement from said array, iii) comparing the value of the test elementwith the value of the random reference element, iv) if the value of saidtest element does not match the value of said random reference elementsearching for a matching element within the neighbourhood of said randomreference element, v) changing a mismatch parameter as a measure ofanomalies in said data array if no matching element within saidneighbourhood of said random reference element is found and selecting anew random reference element, vi) repeating steps iii) to v) a number oftimes. 33. A method according to clause 32 including the steps of: vii)if in step iv) a matching element is found within said neighbourhood ofsaid random reference element performing a comparison of the values ofelements of a group of elements about said first test element with thevalues of a corresponding group of elements about said matching element,viii) if said groups are found to match increasing a comparison value.34. A method according to clause 33 wherein said elements of said groupof elements about said first test element and said elements of saidgroup of elements about said matching element are arranged in the samemanner about said test element and said matching element respectivelyand corresponding elements of said groups are compared in accordancewith a threshold value. 35. A method according to clause 33 in whichstep vi) is repeated until said comparison value is equal to a set valueand when said comparison value is equal to said set value selecting asecond test element and repeating steps i) to vi) for said second testelement. 36. A method according to clause 34, wherein the values arecompared in accordance with a dynamic threshold, the value of whichvaries in accordance with the values of the elements around at least oneof the test elements. 37. A method according to clause 36, including thefurther step of: determining the local gradient at one of said testelements. 38. A method according to clause 39, including the furtherstep of: using said local gradient to determine the dynamic threshold.39. A method according to any of preceding clauses 36 to 38 wherein thedynamic threshold is determined in accordance with the local gradientand a predetermined threshold. 40. A method according to clause 34including the further step of: identifying the particular arrangementsof elements which give rise to a number of consecutive mismatches whichexceeds said threshold and storing data representing such particulararrangements of elements. 41. A method according to clause 40 includingthe further step of: replacing said stored data with corresponding dataof arrangements giving rise to matches falling within the threshold. 42.A computer programmed to perform the method of any of clauses 31-41. 43.A computer program product directly loadable into the internal memory ofa digital computer, comprising software code portions for performing thesteps of any of clauses 31-41, when said product is run on a computer.44. An apparatus for recognising anomalies in data represented by anordered array of data elements each having a value, in respect of atleast some of said data elements, means for selecting a first testelement from said array, means for selecting a random reference elementfrom said array, means for comparing the value of the test element withthe value of the random reference element, means for searching for amatching element within the neighbourhood of said random referenceelement if the value of said test element does not match the value ofsaid random reference element, means for changing a mismatch parameteras a measure of anomalies in said data array if no matching element isfound within said neighbourhood of said random reference element and forselecting a new random reference element. 45. An apparatus according toclause 44, wherein if a matching element is found within saidneighbourhood of said random reference element means are provided toperform a comparison of the values of elements of a group of elementsabout said first test element with the values of a corresponding groupof elements about said matching element, and if said groups are found tomatch means are provided to increase a comparison value. 46. Anapparatus according to clause 45 wherein said elements of said group ofelements about said first test element and said elements of said groupof elements about said matching element are arranged in the same mannerabout said test element and said matching element respectively andcorresponding elements of said groups are compared in accordance with athreshold value. 47. An apparatus according to clause 45, includingmeans for repeating step vi) until said comparison value is equal to aset value and when said comparison value is equal to said set valueselecting a second test element and including means for repeating stepsi) to vi) for said second test element. 48. An apparatus according toclause 46, wherein the values are compared in accordance with a dynamicthreshold, the value of which varies in accordance with the values ofthe elements around at least one of the test elements. 49. An apparatusaccording to clause 48, including means for determining the localgradient at one of said test elements. 50. An apparatus according toclause 49 including means for using said local gradient to determine thedynamic threshold. 51. An apparatus according to any one of clauses48-50, wherein the dynamic threshold is determined in accordance withthe local gradient and a predetermined threshold. 52. An apparatusaccording to clause 46, including means for identifying the particulararrangements of elements which give rise to a number of consecutivemismatches which exceeds said threshold and storing data representingsuch particular arrangements of elements. 53. An apparatus according toclause 52, including means for replacing said stored data withcorresponding data of arrangements giving rise to matches falling withinthe threshold. 54. An apparatus according to clause 44 including meansfor identifying ones of said test elements which give rise to a numberof consecutive mismatches which exceed said threshold. 55. An apparatusaccording to clause 54 including means for storing a definition of eachsuch test elements; and utilising the stored test elements for theprocessing of further data. 56. An apparatus according to clause 54 or55 including means for replacing said identified ones with data whichfalls within the threshold. 57. A computer program product stored on acomputer usable medium, comprising: computer readable program means forcausing a computer to store an ordered array of data elements eachhaving a value, in respect of at least some of said data elements,computer readable program means for causing a computer to select a firsttest element from said array, computer readable program means forcausing a computer to select a random reference element from said array,computer readable program means for causing a computer to compare thevalue of the test element with the value of the random referenceelement, computer readable program means for causing a computer tosearch for a matching element within the neighbourhood of said randomreference element if the value of said test element does not match thevalue of said random reference element, computer readable program meansfor causing a computer to change a mismatch parameter as a measure ofanomalies in said data array if no matching element is found within saidneighbourhood of said random reference element and for selecting a newrandom reference element. 58. A method of recognising anomaliescontained within an array of data elements, each element having a value,including the steps of, in respect of at least some of said dataelements, i) identifying cycles in the set of data in accordance withpredetermined criteria, ii) selecting a test cycle of elements from saidset of data, iii) randomly selecting a comparison cycle from said set ofdata, iv) determining an integration value for said test cycle and saidreference cycle respectively, v) comparing said integration values andderiving therefrom a measure of the difference of said test and saidreference cycles, vi) using said measure to determine a mismatch of saidtest and said reference cycles. 59. A method according to clause 58,including the further step of: vii) randomly selecting further referencecycles and comparing them with the test cycle according to steps v) andvi) and counting the number of mismatches. 60. A method according toclause 58 in which a mismatch is determined by comparing said measure toa threshold value. 61. A method according to clause 59, including thefurther step of: viii) generating a distinctiveness measure as afunction of the number of mismatches between test and reference cycles.62. A method according to any preceding clause, including the furtherstep of: ix) establishing whether the test and reference cycles includethe same number of elements, and if the number of elements are notequal, padding the cycle with fewer elements with elements of set value,so that both cycles contain the same number of elements. 63. A methodaccording to any preceding clause, in which step iv) comprisesdetermining the difference of the sums of values of the element of thetest cycle and the comparison cycle respectively. 64. A method accordingto clause 59 in which step vii) is repeated a set number of times, afterwhich a fresh test cycle is selected. 65. A computer programmed toperform the method of any of clauses 58 to 64. 66. A computer programproduct directly loadable into the internal memory of a digitalcomputer, comprising software code portions for performing the steps ofany of clauses 58 to 64, when said product is run on a computer. 67. Anapparatus for recognising anomalies contained within an array of dataelements, each element having a value, the apparatus including: meansfor identifying cycles in the set of data in accordance withpredetermined criteria, means for selecting a test cycle of elementsfrom said set of data, means for randomly selecting a comparison cyclefrom said set of data, means for determining an integration value forsaid test cycle and said reference cycle respectively, means forcomparing said integration values and deriving therefrom a measure ofthe difference of said test and said reference cycles, means for usingsaid measure to determine a mismatch of said test and said referencecycles. 68. An apparatus according to clause 67, further including:means for randomly selecting further reference cycles and comparing themwith the test cycle, and means for counting the number of mismatches.69. An apparatus according to clause 67, in which a mismatch isdetermined by comparing said measure to a threshold value. 70.

An apparatus according to clause 68 or clause 69, further including:means for generating a distinctiveness measure as a function of thenumber of mismatches between test and reference cycles. 71. An apparatusaccording to any of clauses 67 to 70, further including: means forestablishing whether the test and reference cycles include the samenumber of elements, and if the number of elements are not equal, paddingthe cycle with fewer elements with elements of set value, so that bothcycles contain the same number of elements. 72. An apparatus accordingto any of clauses 68 to 71, wherein said determining means determinesthe difference of the sums of values of the element of the test cycleand the comparison cycle respectively. 73. An apparatus according toclause 68, including means for selecting a fresh test cycle after thecomparison means is repeated a predetermined number of times. 74. Acomputer program product stored on a computer usable medium, comprising:computer readable program means for causing a computer to identifycycles in the set of data in accordance with predetermined criteria,computer readable program means for causing a computer to select a testcycle of elements from said set of data, computer readable program meansfor causing a computer to randomly select a comparison cycle from saidset of data, computer readable program means for causing a computer todetermine an integration value for said test cycle and said referencecycle respectively, computer readable program means for causing acomputer to compare said integration values and deriving therefrom ameasure of the difference of said test and said reference cycles,computer readable program means for causing a computer to use saidmeasure to determine a mismatch of said test and said reference cycles.75. A computer program product stored on a computer usable mediumaccording to clause 74, further comprising: computer readable programmeans for causing a computer to select further said comparison cyclesand comparing them with the test cycle. 76. A computer program productstored on a computer usable medium according to either clause 74 or 75,further comprising: computer readable program means for causing acomputer to generate a distinctiveness measure as a function of thenumber of comparisons for which the comparison indicates a mismatch.

1. A method of recognising anomalies in data representative of an analogue waveform, the analogue waveform having a plurality of cycles, the data comprising an ordered sequence of data elements, each element having a respective value, the method including the steps of: (i) selecting a test group of test elements; (ii) selecting a comparison group of comparison elements; (iii) performing a comparison between the test group and the comparison group, the comparison involving the test elements of the test group on the one hand and the comparison elements of the comparison group on the other hand; (iv) determining as a result of the comparison whether there is a match or a mismatche between the test group and the comparison group; (v) repeating steps (ii), (iii), and (iv), incrementing the value of a mismatch counter each time a mismatch is found; (vi) determining an anomaly measure representative of the anomaly of one or more of the test elements, the anomaly measure being dependent on value of the mismatch counter.
 2. A method as claimed in claim 1, wherein a comparison value is generated as a result of the comparison between the test group and the comparison group, a mismatch being determined in dependence on the generated comparison value relative to a threshold value.
 3. A method as claimed in claim 1 or claim 2, wherein the anomaly measure is the value of the mismatch counter.
 4. A method as claimed in claim 1, wherein the steps (i) to (vi) are repeated so as to generate an anomaly measure for each of the elements in the sequence.
 5. A method as claimed in claim 1, wherein steps (ii), (iii) and (iv) are repeated until a match is found between the test group and the comparison group.
 6. A method as claimed in claim 1, wherein steps (ii), (iii) and (iv) are repeated a predetermined number of times.
 7. A method as claimed in claim 1, wherein the test group includes a reference test element and the comparison group includes a reference comparison element, and wherein the comparison elements are selected such that the respective position of comparison elements in the sequence relative to the reference comparison element is the same as that of the test elements relative to the reference test element, the comparison involving comparing the value of each test element of the test group with the correspondingly positioned comparison element of the comparison group, the mismatch counter being incremented in dependence on the difference between the values of the correspondingly positioned elements in relation to a threshold value.
 8. A method as claimed in claim 7, wherein the position in the sequence of the test elements relative to the reference test element is selected randomly from those elements within a predetermined neighbourhood range relative to the reference test element, and/or wherein the position of the reference comparison elements is selected randomly within a predetermined comparison range relative to the reference test element.
 9. A method as claimed in claim 8, wherein if a match between the test group and a comparison group is found, the step of randomly selecting test elements within the predetermined neighbourhood range is repeated.
 10. A method as claimed in claim 7, wherein the threshold value is dependent on the gradient of the waveform at the point in the waveform which the reference test element represents.
 11. A method as claimed in claim 1, wherein the threshold value is dependent on the gradient of the waveform at some or each of the elements being used to perform a comparison between the elements of the test group and those of a comparison group.
 12. A method as claimed in claim 7, wherein the difference in value of each pair of correspondingly positioned elements in the respective test group and comparison group are compared to a threshold value, the threshold value for each pair being dependent on the gradient of one or both elements of the pair.
 13. A method as claimed in claim 11 or claim 12, wherein the gradient is equal to the difference in value of two adjacent elements.
 14. A method as claimed in claim 1, including the further step of (a) determining if the value of the reference comparison element is within a predetermined range of the value of the reference test element, and if the value of the reference comparison is outside the predetermined range, (b) selecting again a reference comparison element.
 15. A method as claimed in claim 14, wherein the steps (a), (b) of claim 14 are repeated until one of a plurality of stop conditions is met, the stop conditions including: (1) that a match is found between the test group and a comparison group; and (ii) that each element within a test range has been selected as a reference comparison element, the mismatch counter being incremented when a stop condition is met.
 16. A method as claimed in claim 15, wherein if a first comparison reference element is selected that is outside the predetermined range, a second comparison reference element is selected that is a predetermined interval away in the ordered sequence from the first selected comparison reference element.
 17. A method as claimed in claim 1, including the further step of identifying cycles in the set of data in accordance with predetermined criteria, wherein the test group of test elements is formed by one of the identified cycles, and the comparison group of comparison elements is formed by another of the identified cycles, and wherein the step of performing a comparison between the comparison group and the test group includes determining a respective integration value for the test group and the comparison group, and comparing the integration values of each group.
 18. A method as claimed in claim 17, wherein the step of performing a comparison between the comparison group and the test group involves determining a respective combination of the values of the elements of the test group and those of the comparison group, and evaluating the difference in the respective combinations.
 19. A method as claimed in claim 18, wherein the combination is a sum.
 20. A computer programmed to perform the method of claim
 1. 21. A computer program product directly loadable into the memory of a digital computer device, comprising software code portions for performing the steps of claim 1, when the product is run on a computer device.
 22. A computer program product stored on a computer-usable medium, the computer program product being configured for, in use, recognising anomalies in data representative of an analogue waveform, the analogue waveform having a plurality of cycles, the data comprising an ordered sequence of data elements, each element having a respective value, the computer program product having: computer-readable program means for selecting a test group of test elements; computer-readable program means for selecting a comparison group of comparison elements; computer-readable program means for performing a comparison between the test group and the comparison group, the comparison involving the test elements of the test group on the one hand and the comparison elements of the comparison group on the other hand; computer-readable program means for determining as a result of the comparison whether there is a match or a mismatches between the test group and the comparison group; computer-readable program means for determining as a result of the comparison whether there is a match or a mismatches between the test group and the comparison group; and, computer-readable program means for determining an anomaly measure representative of the anomaly of one or more of the test elements, the anomaly measure being dependent on value of the mismatch counter.
 23. Apparatus for recognising anomalies in data representative of an analogue waveform, the analogue waveform having a plurality of cycles, the data comprising an ordered sequence of data elements, each elements having a respective value, the apparatus including: means for selecting a test group of test elements; means for selecting a comparison group of comparison elements; means for performing a comparison between the test group and the comparison group, the comparison involving the test elements of the test group on the one hand and the comparison elements of the comparison group on the other hand; means for determining as a result of the comparison whether there is a match or a mismatches between the test group and the comparison group; means for determining as a result of the comparison whether there is a match or a mismatches between the test group and the comparison group; and, means for determining an anomaly measure representative of the anomaly of one or more of the test elements, the anomaly measure being dependent on value of the mismatch counter. 